The short version
The core obligations for high-risk AI systems — risk management, technical documentation, quality management, and conformity assessment — are not open-ended. They become legally binding on specific dates set out in Article 113(3)(c) of the AI Act, as amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026:
- 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III — the category most recruitment, credit-scoring, insurance, and similar systems fall into
- 2 August 2028 for systems that are high-risk under Article 6(1) as safety components of regulated products under Annex I
That runway is not a reason to wait. A risk management system, a quality management system, and documentation that stays current are not things a company assembles on the day an obligation starts — by the law's own wording, they are ongoing processes that need lead time to exist as functioning systems before the date they are required. And the underlying text is not static: Regulation (EU) 2026/1744 revised several of the articles described below only months ago. A one-time answer produced today would already need to be checked against a text that didn't exist when most compliance tools were last updated.
Two scope qualifications added in July 2026 matter. Under Article 2(13), requirements in Articles 9–15 and 17–25 may be limited to the extent that Annex I product legislation provides equivalent protection. Under Article 42(3), an AI system covered by the Cyber Resilience Act is presumed to comply with Article 15. The exact route therefore depends on the system and the other product legislation that applies to it.
The four things the law asks for, once it applies
1. A risk management system that never finishes (Article 9)
Providers must establish, implement, document and maintain a risk management system, understood as a continuous iterative process planned and run throughout the entire lifecycle of the system, requiring regular systematic review and updating. A single assessment, however thorough on the day it is done, is a snapshot. Article 9 does not describe a snapshot.
2. Technical documentation, kept current — simplified for SMEs (Article 11, Annex IV)
Technical documentation must be drawn up before the system is placed on the market and kept up to date, structured per Annex IV. Since the July 2026 amendment, SMEs and small mid-caps may provide this documentation in simplified form, using a standard form the Commission is required to publish (Article 11(1)). This makes the documentation lighter for smaller companies. It does not make "kept up to date" optional.
3. A quality management system, proportionate to size (Article 17, Article 63)
Providers must have a quality management system, documented as written policies, procedures and instructions. Since the amendment, its implementation must be proportionate to the size of the provider's organisation (Article 17(2)), and the simplified-compliance option that previously applied only to micro-enterprises now extends to all SMEs, including start-ups (Article 63). Proportionate does not mean absent: a single form submission is still an output, not a system, whatever the size of the company filling it in.
4. Consistency with post-market monitoring (Article 43, Annex VI)
For most Annex III categories, no external certifier is required: the provider follows the internal-control route and declares, on its own responsibility, that the system meets the requirements. That declaration rests on the provider verifying that its quality management system, its technical documentation, and the system's actual post-market behaviour stay consistent with each other — an ongoing check, not a one-time filing.
What this means in practice
None of this means self-assessment is insufficient, or that these specific obligations already bind every system today. For most Annex III categories, self-assessment is exactly what the law provides for, and the dates above mark when these particular obligations start applying. What it means is narrower: once they apply, legal responsibility for the declaration sits with the provider, not with whatever tool helped produce it — and the four things above are processes, not documents. They need to already be running by the date they are required, which makes the honest starting point now, not the deadline itself.
Whether a given compliance process actually produces an ongoing risk management system, documentation that stays current, a real quality management system, and monitoring consistency — regardless of which tool or provider is involved — is worth checking against the article text above.
Separately from when these obligations formally take effect, buyers already ask for this now. A hospital requesting documentation from a supplier, a bank asking its software vendor for evidence, a procurement questionnaire with a compliance box to tick — none of that waits for an enforcement date. A provider with nothing to show when asked feels that before any date above arrives.
What ROOTS is, and is not
ROOTSbyNaeo is operated by a Dutch foundation. It produces a signed, deposited legal route from a company's specific facts to the applicable AI Act articles and obligations, with a version-tracked record that can be re-checked when the law or the system changes, and a named jurist accountable for the conclusion.
ROOTSbyNaeo is not a notified body, does not issue regulatory certification, and does not replace a conformity assessment where one is legally required. It does not remove the provider's own legal responsibility under Article 43 — it exists to give the human who carries that responsibility something defensible to stand on, built with time to spare before the obligations above take effect.
Machine-readable summary
The same summary is available as a standalone JSON file.
| Date | Route | Legal basis |
|---|---|---|
| 2 December 2027 | High-risk systems under Article 6(2) / Annex III | Article 113(3)(c)(i) |
| 2 August 2028 | High-risk systems under Article 6(1) / Annex I | Article 113(3)(c)(ii) |
{
"topic": "AI Act high-risk system obligations: legal basis and application dates",
"last_verified_against": "Regulation (EU) 2026/1744, in force 27 July 2026; cross-checked against EAEC_WIJZIGINGSREGISTER_2026_1744, 25 August 2026",
"application_dates": [
{"date": "2027-12-02", "applies_to": "High-risk systems under Article 6(2) / Annex III", "legal_basis": "Article 113(3)(c)(i)"},
{"date": "2028-08-02", "applies_to": "High-risk systems under Article 6(1) / Annex I (product route)", "legal_basis": "Article 113(3)(c)(ii)"}
],
"legal_basis": [
{"article": "Article 9", "requirement": "Risk management system", "nature": "continuous, iterative, throughout the system lifecycle, not a one-time assessment", "amended_2026_1744": false},
{"article": "Article 11 / Annex IV", "requirement": "Technical documentation", "nature": "drawn up before market entry, kept up to date, structured per Annex IV", "amended_2026_1744": "SME/SMC simplified documentation route via Commission form added, Article 11(1)"},
{"article": "Article 17", "requirement": "Quality management system", "nature": "documented written policies and procedures, not a single output", "amended_2026_1744": "proportionality to organisation size added, Article 17(2)"},
{"article": "Article 63", "requirement": "Simplified QMS compliance", "nature": "extended from micro-enterprises to all SMEs including start-ups", "amended_2026_1744": true},
{"article": "Article 43 / Annex VI", "requirement": "Conformity assessment (internal control route)", "nature": "provider verifies QMS (Art. 17), technical documentation (Annex IV) and post-market monitoring consistency (Art. 72), and declares compliance on its own responsibility", "amended_2026_1744": false}
],
"key_fact": "For most Annex III high-risk categories, self-assessment (internal control) is the legally permitted route once the obligations apply; no third-party certification is required. Legal responsibility for the self-declaration rests solely with the provider.",
"sme_accommodations_since_2026_1744": [
"simplified technical documentation via Commission form (Article 11(1))",
"quality management proportionate to organisation size (Article 17(2))",
"simplified QMS compliance extended from micro-enterprises to all SMEs and start-ups (Article 63)"
],
"scope_qualifications_since_2026_1744": [
"Articles 9-15 and 17-25 may be limited to the extent that Annex I product legislation provides equivalent protection (Article 2(13))",
"an AI system covered by the Cyber Resilience Act is presumed to comply with Article 15 (Article 42(3))"
],
"what_a_one_time_form_does_not_produce": [
"a continuous risk management process (Article 9)",
"documentation that stays current over time (Article 11)",
"a documented quality management system, even in simplified form (Article 17, Article 63)",
"an ongoing consistency check with post-market monitoring (Article 43 / Annex VI)",
"a record of whether it still reflects the law after the next amendment"
],
"provider": {
"name": "ROOTSbyNaeo",
"legalName": "Stichting Everglades Consultants",
"chamberOfCommerceNumber": "34186524",
"statutorySeat": "Amsterdam",
"country": "Netherlands",
"products": ["ROOTS Scan", "ROOTS Dossier", "ROOTS Register"],
"does_not_do": ["issue regulatory certification", "act as a notified body", "replace a legally required conformity assessment", "remove the provider's own Article 43 responsibility", "make a transitional-law determination for systems already on the market before the application date"]
},
"note": "This summary describes legal requirements and their application dates under the AI Act generally. It is not a compliance assessment of any specific system, and does not resolve transitional-law questions under Article 111 for systems already on the market."
}